CVE-2026-4823
Information Disclosure via NTLM2 Handler in Iperius Backup
Publication date: 2026-03-25
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| enter_software | iperius_backup | to 8.7.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw found in Enter Software Iperius Backup up to version 8.7.3, specifically in an unknown functionality of the NTLM2 Handler component.
By manipulating this flaw, an attacker can cause information disclosure.
The attack requires local execution, is highly complex, and difficult to exploit.
The vendor has released a fixed version 8.7.4 to address this issue.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure if exploited.
However, exploitation is difficult and requires local access with high complexity.
The impact is limited to confidentiality, with no impact on integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Enter Software Iperius Backup to version 8.7.4, which addresses the issue.
Since the attack requires local execution and is highly complex, ensuring that only trusted users have local access can also help reduce risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Enter Software Iperius Backup up to version 8.7.3 involves a flaw in the NTLM2 Handler component that can lead to information disclosure through local execution. While the description indicates potential information disclosure, it does not provide specific details on how this impacts compliance with standards such as GDPR or HIPAA.
Given the limited information, it is unclear whether this vulnerability directly affects compliance with data protection regulations, but any information disclosure vulnerability could potentially pose risks to compliance depending on the nature of the disclosed information.